NOTE: Only available for some types of directory accounts.
On the Connection tab, you can configure Safeguard for Privileged Passwords to authenticate to a managed system using an account from an external identity store such as Microsoft Active Directory. In order to use this authentication type, you must first add a directory asset to Safeguard for Privileged Passwords and add domain user accounts. Managed account users cannot be members of the Protected Users AD Security Group. For more information, see Accounts.
| Property | Description |
|---|---|
| Service Account Name |
Click Select Account. Choose the service account name used for management tasks. The accounts available for selection are domain user accounts that are linked to a directory that was previously added to Safeguard for Privileged Passwords. |
|
Service Account Password |
If required, enter the password used to authenticate. |
| Privilege Elevation Command |
If required, enter a privilege elevation command (such as sudo). This is used as a prefix for commands that require privileged access on the system and to manage accounts on Unix-based systems; that is, to check and change SSH keys and to discover accounts. Sudo commands follow.
Specify a program to look up the user's public keys
When adding an asset, this command is used to perform Test Connection. For more information, see About Test Connection. The privilege elevation command must run non-interactively, that is, without prompting for a password. For more information, see Preparing Unix-based systems. The limit is 255 characters. |
| Test Connection |
Click this button to verify that Safeguard for Privileged Passwords can log in to this asset using the service account credentials you have provided. For more information, see About Test Connection. |
|
Service Account Profile |
 Edit to add the profile or — Remove to delete the assigned profile. Available profiles are based on the partition selected on the General tab (asset discovery). To update the profile later, go to the service account and update the profile. For more information, see General tab/Properties (account). |
|
Use Named Pipe for service account connection |
Select to use the Named Pipe when connecting to the asset. Clear this check box to use TCP/IP when connecting to the asset. |
| Use SSL Encryption |
Selected by default, this option is used to enable Safeguard to encrypt communication with this asset. To support SSL on Active Directory, you must upload the SSL certificate being used by the Active Directory forest. The SSL binds will need to be on port 636. For information on this process within Active Directory, see Enable LDAP over SSL with a third-party certificate authority. If you do not select this option for a MicrosoftSQL Server that is configured to force encryption, Test Connection will use untrusted encryption and succeed with valid credentials. For more information about how Safeguard database servers use SSL, see How do Safeguard for Privileged Passwords database servers use SSL. |
| Verify SSL Certificate |
Use this option to enable or disable SSL Certificate verification on the asset. When enabled, Safeguard for Privileged Passwords compares the signing authority of the certificate presented by the asset to the certificates in the Trusted CA Certificates store every time Safeguard for Privileged Passwords connects to the asset. Trust must be established for Safeguard for Privileged Passwords to manage the asset. For Safeguard for Privileged Passwords to verify an SSL certificate, you must add the asset's signing authority certificate to the Trusted CA Certificates store. Only clear the Verify SSL Certificate option if you do not want to establish trust with the asset. |
| Privilege Level Password | If required, enter the system enable password to allow access to the Cisco configuration. |
| Auto Accept SSH Host Key |
Select this option to have Safeguard for Privileged Passwords automatically accept an SSH host key. When an asset requiring an SSH host key does not have one, Check Password will fail. For more information, see Connectivity failures. |
| Instance |
Specify the Instance name if you have configured multiple instances of a SQL Server on this asset. If you have configured a default (unnamed) instance of the SQL Server on the host, you need to provide the IP address and port number. |
| Port |
Enter the port number to log in to the asset. This option is not available for all operating systems. |
| Connection Timeout |
Enter the directory connection timeout period. Default: 20 seconds. |